Privacy Policy

1. Who we are

This Privacy Policy explains how Pingly App Limited ("Pingly", "we", "us"), a company registered in Cyprus, collects, uses, and protects your personal data when you use the Pingly mobile application and the pingly.info website (together, the "Service").

Registered address: EDEN BEACH APARTMENTS, BLOCK 4, Office 112, 3035 Limassol, Cyprus. Company registration number: ΗΕ 446708. Contact for privacy questions: anna@pingly.info.

2. What data we collect

Pingly connects to third-party services you choose to link, and processes the following categories of personal data:

• Account data: name, email address, and authentication tokens created when you sign up.
• Email data: message metadata and content from Gmail and/or Outlook accounts you connect via OAuth, limited to what is needed to display and summarize your inbox.
• Calendar data: event titles, times, participants, and locations from calendars you connect.
• Task data: tasks and to-do items you create or import within Pingly.
• Topics and Keywords: the interests, subjects, people, companies, teams, or terms you choose to have Pingly monitor for you.
• News and content data: publicly available news articles, company announcements, and other public content retrieved and summarized based on your Topics and Keywords.
• Usage and device data: app interactions, crash logs, device type, and operating system, used to keep the Service reliable and secure.
• Approximate location: where permitted by your device settings, we store your approximate location, rounded to about 1 km, to show local weather and tips. A stored location is no longer used after 3 days.
• AI conversation data: prompts and responses exchanged with Pingly's AI assistant features.
• Assistant memory: short facts you tell the assistant, which it remembers so it can personalize its answers to you.
• iCloud Mail and iCloud Calendar (optional): if you connect iCloud, your iCloud email address and an app-specific password you create with Apple; your email (sender, recipients, subject, content, read and starred status) and calendar events (title, description, date and time) when Pingly shows them.
• Telegram (optional): if you connect Telegram, your chat list, messages, and chat names — stored only on your device. See the Telegram section below.

3. Google user data (Gmail and Google Calendar)

Google user data we access. If you connect Gmail, Pingly accesses: your Google account email address; Gmail message headers (sender, recipients, subject, date), snippets, labels (including read/unread and starred status), and message content when you open, send, or reply to mail; and Google Calendar events on your primary calendar (title, description, time, and timezone). If you sign in with Google, we also receive your Google email address and basic profile information (name and profile photo) to create your Pingly account.

How we use it. This data is used only to provide and improve user-facing Pingly features: showing your inbox, sending and organizing mail, showing calendar events, sending email and calendar notifications, and generating your daily brief. We do not use Google user data to train generalized AI/ML models.

What we store. We store your Gmail address and OAuth tokens so the app can stay connected. We do not store a copy of your full inbox. We store Gmail message IDs to avoid duplicate notifications, upcoming Google Calendar event IDs, titles, and times for reminders, and a short generated daily brief that may mention senders, subjects, and event titles. Message bodies are fetched when needed and kept on your device for display.

Limited Use. Pingly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide or improve user-facing features. It is never sold. It is never used for advertising, including personalized, retargeting, or interest-based ads. It is not transferred to third parties except to service providers that are necessary to operate those features (currently: Supabase for hosting and storage; Google Gemini to generate the daily brief from email metadata, snippets, and calendar event titles; and Expo and Apple/Google push services to deliver notifications). Those providers may process the data only to provide that service to us. Humans do not read Google user data except with your consent, for support, for security, or where required by law.

Disconnect and delete. You can disconnect Gmail in the app, which deletes stored tokens and related sync data. Deleting your Pingly account removes associated Google connection data from our systems.

4. Telegram

Pingly can connect to your Telegram account using Telegram's official API. Pingly is not affiliated with Telegram.

• What we access: the phone number you log in with (sent directly to Telegram), and your chat list, messages, and the names of the people and groups you chat with.
• Where it's stored: only on your device, in an encrypted database. Your Telegram data, session, and phone number are never sent to Pingly's servers.
• Telegram processes this data under its own privacy policy: https://telegram.org/privacy
• We don't use Telegram data for AI features, analytics, or advertising, and we don't share it.
• To remove it: disconnect Telegram in Pingly (Emails → Accounts) or sign out of Pingly. You can also end the session in Telegram under Settings → Devices.

5. Apple iCloud Mail and iCloud Calendar

Connecting iCloud uses an app-specific password you create at appleid.apple.com. Pingly is not affiliated with Apple.

• What we access: your iCloud mail (read, send, reply, star, delete) and your iCloud Calendar events (read only). We don't access your contacts.
• Our server connects to Apple's mail and calendar servers on your behalf over encrypted connections.
• What we store: your iCloud email address, and your app-specific password encrypted with AES-256-GCM. We don't store your email or calendar content on our servers.
• To remove it: disconnect iCloud in Pingly (Emails → Accounts). To stop all access, also revoke the app-specific password at appleid.apple.com.

6. How we use your data and our legal bases

We process personal data under the following legal bases available under the EU General Data Protection Regulation (GDPR):

• Performance of a contract — to provide the core functionality you request, such as displaying your mail, calendar, and tasks in one place.
• Consent — for connecting third-party mail/calendar accounts via OAuth, for optional AI features, and for any non-essential cookies or tracking on our website.
• Legitimate interests — for service security, fraud prevention, and improving the Service, balanced against your rights and expectations.
• Legal obligation — where we must retain or disclose data to comply with applicable law.

Telegram and iCloud: to show and send your messages, email and calendar in Pingly at your request (performance of a contract, GDPR Art. 6(1)(b)).

Approximate location and assistant memory: to show local weather and tips, and to personalize the assistant's answers to you (performance of a contract, GDPR Art. 6(1)(b)). You can turn off location access for Pingly in your device settings at any time.

7. AI features and automated processing

Pingly uses artificial intelligence models to summarize messages, organize tasks, monitor your chosen Topics and Keywords across public news sources, and power conversational "AI threads".

• You are always informed when you are interacting with an AI-generated summary or an AI assistant rather than a human.
• AI processing of your email and calendar content is used solely to generate the output you requested (e.g. a summary, a suggested reply, a scheduling suggestion) and is not used to build advertising profiles.
• Pingly does not make decisions producing legal or similarly significant effects about you based solely on automated processing, without the possibility of human review.

Telegram data is never used for AI features. iCloud email and calendar content isn't sent to our AI provider, unless you save it in a note, since notes can be summarized with AI.

Facts the assistant remembers about you are used only to personalize its answers to you. They are not used to build advertising profiles.

8. How long we keep your data

We retain personal data only for as long as necessary for the purposes described in this policy. Your account and personal data are kept for as long as your account is active, and are deleted within 90 days after your account is closed, unless a longer period is required by law. Telegram data is kept only on your device until you disconnect, sign out, or uninstall the app. Your iCloud address and encrypted password are kept until you disconnect iCloud or delete your account. Your approximate location is no longer used after 3 days, and both your stored location and the facts the assistant remembers are deleted when you delete your account.

9. Who we share your data with

We do not sell your personal data. We share data only with service providers ("sub-processors") who help us operate Pingly, under contractual data protection terms:

• Google (Gmail API, OAuth) and Microsoft (Outlook/Graph API) — to retrieve mail and calendar data you have authorized.
• Google Gemini — AI model provider used to generate summaries, suggestions, and AI thread responses.
• Exa — search/data-retrieval API used to power certain AI features.
• Google Cloud — hosts our backend servers (Finland, EU).
• Supabase — our database and account authentication (AWS, Stockholm, Sweden, EU).
• Expo, and Apple/Google push notification services — to deliver reminders, mail, and calendar notifications to your device.

Telegram and Apple are not sub-processors: when you connect them, Pingly accesses your own Telegram or iCloud account at your request, under their own privacy policies.

10. International data transfers

Our servers are located in the EU (Google Cloud in Finland, Supabase on AWS in Stockholm), and our service providers process your data within the European Economic Area (EEA). When you connect Telegram or iCloud, data is exchanged with their servers, which may be outside the EU, at your request. If our own processing moves outside the EEA in the future, we will update this policy to describe the safeguards that apply, such as the European Commission's Standard Contractual Clauses.

11. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), including by deleting your account.
• Restrict or object to certain processing.
• Data portability, i.e. receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent, without affecting past lawfulness.
• Lodge a complaint with a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection, or the supervisory authority in your own EU member state.

To exercise any of these rights, contact us at anna@pingly.info. We will respond within one month as required by law.

12. Deleting your account and data

This section explains how to delete your account and data in Pingly, the app by Pingly App Limited.

Delete your account: in Pingly, tap your profile picture at the top of the screen, scroll down, tap "Delete account" and confirm. You can also email anna@pingly.info and ask us to delete it. Your account and all associated data, including your stored approximate location and the facts the assistant remembers about you, are deleted immediately, and removed from backups within 90 days. Cancel any active subscription in the App Store or Google Play first.

Delete specific data (your account stays):

• Email accounts and Telegram: Emails → settings icon → Accounts → ✕ → Disconnect.
• Notes: delete the note, then delete it from Notes → Trash.

What is kept: purchase records kept by Apple or Google, data we're required by law to keep, and technical logs, which are deleted automatically within 30 days.

13. Security

We apply appropriate technical and organizational measures — including encryption of data in transit, access controls, and OAuth token scoping — to protect your data against unauthorized access, loss, or misuse. Telegram data on your device is stored in an encrypted database whose key isn't included in device backups. Your iCloud app-specific password is encrypted (AES-256-GCM) on our servers and never stored on your device.

14. Children

Pingly is not directed at children under 13, and we do not knowingly collect personal data from children under that age. If you are aged 13-17, you may only use Pingly with the permission of a parent or legal guardian.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app or by email before they take effect.

16. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at anna@pingly.info.